Method for acquiring access rights to conditional access content

ABSTRACT

A method of acquiring access rights to conditional access content. The method comprises receiving an access right on a first terminal through a first communication channel; storing said access right in said first terminal; sending a request for said conditional access content to a content provider, said request containing at least an identifier of an account to which said first terminal is associated, an identifier of the requested content and a piece of information concerning said access right; verifying, by said content provider, the authenticity of said access right using said piece of information concerning the access right; and when there has been a successful verification, marking said access right as used, and sending said conditional access content to at least one terminal linked to said account. The first terminal using near field communication technology (NFC) during at least one transfer of said access rights.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. application Ser. No.16/527,940, filed Jul. 31, 2019, which is a continuation of U.S.application Ser. No. 14/202,818, filed Mar. 10, 2014, which claims thebenefit of U.S. Provisional Application No. 61/775,737, filed Mar. 11,2013. The entire contents of all of which are incorporated herein byreference.

TECHNICAL FIELD

Embodiments disclosed herein relate to a method for acquiring accessrights to conditional access content.

More specifically, disclosed embodiments relate to the acquisition of aright received by a user's first terminal and the transfer of said rightsuch that it can be used on a user's second terminal, the first terminalusing Near Field Communication (NFC) technology during at least oneoperation for the transfer of the right.

BACKGROUND ART

Near Field Communication Technology, known by the acronym “NFC”, is awireless, high frequency communication technology, having a range of afew centimeters, for the exchange of information between multipledevices. This technology is derived from a combination of a smart cardinterface and a contactless reader in a single device.

An NFC device is able to communicate with other NFC devices as well asdevices operating in accordance with ISO 14443 (contactless smart cards)standard.

NFC standards cover the NFC communication protocols and data exchangeformats and are based on existing standards for radio frequencyidentification (RFID) such as ISO/IEC 14443, FeliCa and ISO/IEC 18092.They include standards defined by the “NFC Forum”, which was founded in2004 by Nokia, Philips and Sony and includes more than 180 members.

NFC is an extension of RFID technology, allowing two-way communicationbetween two devices, while previous systems, such as contactless smartcards, allowed only one-way communication.

NFC technology is usable only over a short distance of about a fewcentimeters, which implies a voluntary use and prevents unintentionaluse.

NFC devices can be active or passive. A passive NFC device, such as atag, smart card or a simple chip affixed to an object containsinformation only readable by other NFC-enabled devices. A passive NFCdevice is powered by the electromagnetic field generated by a reader(active device) and therefore does not need its own power supply.

An active NFC device, however, is a device that generates anelectromagnetic field. This generation can be done to communicate with apassive device (described above) or to establish a communication channelbetween two active devices.

The fact that a device like a smartphone has a power supply does notnecessarily mean that it will work in active mode only. That is, asmartphone can handle the NFC interface in active or passive modes. Inpassive mode, the device emulates a chip card. In this mode, thesmartphone (or any other portable device such as tablets) will store, ina secure memory, information that is normally stored in a card. Thus,when the smartphone detects an electromagnetic field, it can access thesecure memory and a corresponding device having NFC capacities will beable to read information in passive mode from the secure memory.

The following are examples of known applications that use NFCtechnology:

-   payment using a credit card or contactless mobile device (e.g.,    mobile phone, smartphone, laptop, tablet computer . . . ) on a    contactless payment terminal;-   payment for a parking space on a terminal accepting contactless    payment using an NFC mobile terminal;-   contactless purchase of a ticket and contactless validation of a    ticket displayed on a mobile phone;-   management of coupons, loyalty points, etc. in a store, at    retailers, etc. (e.g., couponing);-   accessing and starting a vehicle using a mobile phone;-   reading product information (e.g., price, composition, allergy,    etc.) in a store;-   controlling physical access to premises (e.g., meeting room,    business, classroom, etc.);-   exchanging profiles between users of a social network or of a game    by bringing phones close together (e.g., user peer-to-peer    communications);-   reading an electronic business card with a PDA (Personal Digital    Assistant);-   synchronizing Internet bookmarks and contacts between a PDA and a    mobile phone;-   recovering key to a WiFi access point approaching an NFC device from    an authorized terminal;-   accessing automation features of a building.

SUMMARY

Among the different possible applications of NFC technology, some ofthem concern the storage and the transfer of rights. In the embodimentdisclosed herein, NFC technology is used in connection with a firstterminal that receives rights, to store and to transfer rights in asecond terminal and to use the rights in a remote place.

Objects of the disclosed embodiments are achieved by a method ofacquiring access rights to conditional access content. The methodcomprises:

-   receiving an access right on a first terminal through a first    communication channel;-   storing said access right in said first terminal;-   sending a request for said conditional access content to a content    provider, said request containing at least an identifier of an    account to which said first terminal is associated, an identifier of    the requested content and a piece of information concerning said    access right;-   verifying, by said content provider, the authenticity of said access    right using said piece of information concerning the access right;    and-   when there has been a successful verification, marking said access    right as used, and sending said conditional access content to at    least one terminal linked to said account;-   said first terminal using a near field communication technology    (NFC) during at least one operation for the transfer of said access    rights.

The embodiments disclosed herein are useful when a user has at least twoterminals, one of these terminals being mobile and having near fieldcommunication (NFC) capabilities. The second terminal is a terminal onwhich the content can be used. Such a terminal can be e.g., a TV set,tablet, computer, mobile phone (smartphone), PDA or a digital radio.According to the embodiments disclosed herein, the user can have severalterminals using the content, said terminal being linked to a user'saccount.

The embodiments disclosed herein use NFC technology during at least oneright transfer operation, i.e., either during the acquisition of theright, during the transfer of the right from an access right provider ora shop to a user's first terminal, during the transfer of the right froma user's first terminal to a second terminal, or during both transferoperations.

The use of NFC technology at least at the level of the first terminalforces at least one communication of this terminal to be local, whichensures greater security than remote communications would provide.

BRIEF DESCRIPTION OF THE DRAWINGS

The embodiments disclosed herein and their advantages will be betterunderstood with reference to the enclosed drawings and the followingdetailed description, in which:

FIG. 1 illustrates a system used for the implementation of a firstembodiment disclosed herein;

FIG. 2 is a block diagram illustrating a method of the first embodiment;

FIG. 3 illustrates a system used for the implementation of a secondembodiment disclosed herein;

FIG. 4 is a block diagram illustrating a method of the secondembodiment;

FIG. 5 illustrates a system for the implementation of a third embodimentdisclosed herein; and

FIG. 6 is a block diagram illustrating a method of the third embodiment.

DETAILED DESCRIPTION

The method disclosed herein is typically used in the field of homenetworks. Such networks can comprise several terminals such as e.g., TVsets, mobile phones, smartphones, tablets or computers. In such anetwork, the different devices or terminals often have some of the samerights and some different rights. Thus, it is possible that e.g., a useris authorized to view a movie on his/her tablet as often as he/shewishes during a three day period, but only once, at any time, on his/herTV set. In such a context, it is important that the rights for anauthorized user are managed in an efficient and correct way and that anon-authorized user cannot benefit illegally from these rights.

In the framework for describing the embodiments of the invention, a userhas at least one first terminal that is in charge of acquiring an accessright and a second terminal that is used to access to the content.

With reference to the system illustrated in FIG. 1, the method disclosedherein uses a first device or a first terminal T1 comprising both aremote communication mechanism and a local communication mechanism. Sucha terminal T1 can be e.g., a mobile phone or a tablet among others. Thelocal communication mechanism uses NFC technology and enables a localcommunication at short distance, typically in the range of a fewcentimeters. The remote communication mechanism can be a conventionalmechanism using for example the GSM network.

The method disclosed herein also uses a second terminal T2 on which thecontent is used, as will be explained below in more detail.

The method further requires the presence of an access right provider ARPand a content provider CP.

FIG. 2 illustrates a first embodiment of the method disclosed hereinusing the elements illustrated in FIG. 1. In a first step, a user goesto an access right provider ARP with the first terminal T1. This accessright provider ARP can typically be a shop, cinema, theater, etc. havinga terminal using NFC technology. The user can receive an access righte.g., as a commercial offer, after having purchased goods for a givenamount, after having attended a show or a movie, or after having used agiven service. In order to acquire said right, the user places its firstterminal T1 close to a terminal of the access right provider ARP. Theright for said user is then transmitted from the provider's terminal tothe user's first terminal T1, using NFC technology. The concerned rightis then stored in a memory of the first terminal T1.

According to a first embodiment, the implementation of the methodrequires the prior registration of the user at a management center MC.This registration enables the management center to acquire data used forsending management messages to the concerned user. This registrationfurther enables sharing keys with the registered receiver devices. Thesekeys can be common to several terminals of a single user or they can beindividual and different for each terminal. These keys can be the samefor the management center MC and the receiver or, conversely, they canbe different, the key in the management center MC and the key at theuser's side being both keys of a private-public key pair.

The registration of the user's terminals at the management center MCenables a targeted transmission of the management messages containingthe rights to the concerned receiver device. These rights are usuallyencrypted by a key enabling the receiver to decrypt the messagesreceived. When a user is registered, an account is normally created;this account groups all of the terminals of the user's home network.Thus, the management center MC is able to manage all of the user'sterminals and associate their usage rights, which can vary individuallyfor each terminal.

According to an alternative embodiment, the user's terminals are notregistered in advance. When a right is received by the first terminalT1, a request Rq is sent to the management center MC. This requestcontains all of the elements that are required for sending the contentto a given terminal of the concerned user.

In the embodiment illustrated in FIGS. 1 and 2, when the right is storedin the user's first terminal T1, a request Rq is sent to the managementcenter MC by this first terminal T1. If a prior registration of the userhas been made, the request can contain a right and a mechanism forverifying its authenticity. The content provider CP has the mechanismfor determining which account the user who sent the right is associatedwith. It is thus not necessary that this information be in the request.It could, however, be introduced in the request to enable a verificationprocess if desired.

If, on the other hand, no previous registration has been made, therequest Rq must contain information concerning the user's terminal towhich the content provider CP must send the content to.

At this stage, the content provider CP has the information concerningthe concerned user (independent from the fact that a previousregistration was requested or not). In particular, the content providerhas, for each user, an account enabling it to identify the differentterminals associated with that user.

As mentioned previously, the request contains, among others, the rightand a mechanism for verifying its authenticity. The request can furthercontain a mechanism for identifying the author of the right, possiblyvalidity conditions such as a date, and possibly information related tothe user's terminal on which the content will be used.

In this embodiment, the request Rq is sent by a remote communicationchannel. According to a desired embodiment, the first terminal T1 is amobile phone such as a smartphone and the rights are transmitted to thecontent provider CP by GSM.

When the management center MC receives the request containing the right,the center determines the origin of the request and associates thisrequest to the account of the user. The determination of the user'saccount also enables determining keys associated with the account, whichenables verifying the authenticity of the right received. Several wellknown methods exist for verifying the authenticity of the rights. Onemethod, which can for example be used in the present embodiment,comprises integrating with the right, a verification code that can bee.g., the result of a one way function using a key, said function beingapplied to the right. When the request is received, the managementcenter MC can apply the same one way function with the same key, todetermine if the right contained in the request is authentic.

When this verification step has successfully been performed, themanagement center MC determines which content Ct corresponds to theright said provider received. In the illustrated example, the managementcenter MC also contains content that can be sent to the users.Therefore, the management center also plays the role of content providerCP.

According to the first embodiment, each right corresponds to specificcontent. According to a specific example, the access right provider ARPcan be a movie theater. The right can enable accessing, for a reducedprice, a movie from the same distributor which distributed the movie theuser has viewed in this theater. According to another example, the userobtains the right to download the music of the movie he/she viewed.

The disclosed embodiment can be used for e.g., in any commercial shopfor various purposes (e.g., discount coupons, gifts, . . . )

According to a second embodiment disclosed herein, a right does not havea one-to-one correspondence to specific content (e.g., an event, aservice or a discount). In this embodiment, it is necessary to acquireseveral rights before being authorized to access to the content. As anexample, it may be necessary to receive five rights from a movie theaterto obtain the possibility of downloading one movie for free. In thiscase, the rights can be collected and stored in the user's firstterminal T1 and sent when all of the collected rights enable the accessto a good or service. The rights can also be collected and stored by thecontent provider CP or the management center MC, for example, and linkedwith the user's account. In this case, each right is sent to the contentprovider. The content provider suggests a product when the stored rightsenable access to this product.

According to an alternative embodiment, the products proposed varydepending on the number and/or the value of the rights accumulated. Inother words, the goods do not “cost” the same number of rights. Forexample, a content provider can propose the downloading of the music ofa movie for a “value” of one right, the viewing of an already seen moviefor three rights, the viewing without storage for four rights and theviewing of the same movie with storage for six rights. The user willthus be able to choose different goods depending on the number of rightsaccumulated. The number of rights deducted from the user's accountdepends on the goods chosen by said user.

When the user has chosen the content he wishes to access, after theappropriate verifications such as e.g., a verification concerning theauthenticity of the right and the verification of the suitabilitybetween the right requested for the concerned content and the rightsavailable for this user, the content Ct can be transmitted to the user.This transmission is made on one of the user devices, referred to assecond terminal T2. The transmission is accompanied with conditions ofuse. In particular, the conditions of use indicate which operations canbe made with the content sent to the second terminal T2. Theseoperations are, for example, viewing only, without the right to storethe content, or alternatively, the right to store the content. Theseoperations can also concern the quality of the images (resolution), ortemporal constraints such as e.g., viewing during one week. Theoperations can also be linked to a number of viewings (single ormultiple viewings).

When the rights are valid, and when the provider has determined whichterminal the content must be sent to, the provider sends the content tothe concerned terminal together with the conditions of use. Thisterminal thus uses the content according to the associated conditions ofuse.

In the embodiment illustrated in FIGS. 3 and 4, the user's firstterminal T1 receives the rights through NFC in a way that is similar towhat has been described above with reference to the embodimentillustrated in FIGS. 1 and 2. The rights are also stored in the firstterminal T1. In the present illustrated embodiment, the rights are thentransmitted from the user's first terminal T1 to the second terminal T2,which, in the example illustrated, is a multimedia unit. Thistransmission can be made by a short distance communication channel(e.g., through NFC) if the second terminal has a communication mechanismfor this technology. Other communication mechanisms can also be used,such as for example Wifi or Bluetooth.

When the second terminal T2 has received the rights, the terminalprepares a response similar to the request sent by the first terminal inthe embodiment illustrated in FIGS. 1 and 2. This request Rq is sent tothe content provider CP, or the management center MC, which processesthis request, proceeds with the requested verifications andauthentications. The content provider then determines which terminalsassociated with the user's account the content must be sent to. Thisdetermination can be e.g., made from the content of the request. Thecontent provider further adds the conditions of use and transmits thecontent and the conditions of use to the concerned terminal.

In the embodiment illustrated in FIGS. 3 and 4, the concerned terminalcan be the multimedia unit that sent the request, another multimediaunit, a tablet or any similar terminal.

It should be noted that the conditions of use could be different indifferent terminals. For example, the embodiment can limit the use ofthe content to a single viewing on the multimedia unit and/or limit theuse of the same content on the tablet to an unlimited number of viewingsin one week.

In the embodiment of FIGS. 5 and 6, the first terminal T1 comprises aremote communication mechanism as well as a local communicationmechanism. Such a terminal can be a mobile phone (smartphone) or atablet. The local communication mechanism uses NFC technology andenables a local communication at a very short distance, typically in therange of a few centimeters. The remote communication mechanism can be aconventional communication mechanism using e.g., the GSM network.

In the method illustrated in FIG. 5, the access right provider ARP sendsrights to a user, more specifically to the user's first terminal,through a remote communication mechanism. This transmission cantypically use the GSM network. These rights can be sent encrypted orunencrypted as they are addressed individually to each concerned user.

When the message containing the rights is received by the first terminalT1, the rights are extracted from the message before being stored in thefirst terminal. According to the desired security level, the right canbe encrypted or, on the contrary, stored in unencrypted form.

The encryption key used for the storage of the rights is advantageouslya key that is common to all of the devices belonging to the user (forexample, a key associated with the user's account). Thus, when a rightis transmitted from the first terminal to a user's second terminal, thisright can be read by all of the user's terminals.

In the following steps of the disclosed method, the rights aretransmitted from the first terminal T1 to a second terminal T2 usinglocal communications, and more specifically, a near field communication(NFC) mechanism. In order to transfer a right by using thiscommunication mechanism, the receiver device must be placed at a shortdistance from a reader integrated with the user device.

The rights received by a second terminal must be validated prior tobeing usable. In order to perform this validation, a request istransmitted to the content provider or management center, similar to themethod discussed above with respect to the embodiment of FIGS. 3 and 4.The content provider determines which terminal the content must be sentto and what are the conditions of use associated with the content and/orthe terminal. The content is then sent to the concerned terminal in aconventional way. The method disclosed herein forces a near fieldcommunication, which forces a proximity between the user's terminals andconsequently, a voluntary step made by the user, which lowers the risksof fraud.

According to a desired embodiment, once a right is used (i.e.,transferred from a reception device to a device in which it is used),said right is deleted from the reception device or marked as non usable.This prevents the same right from being used several times, for example,on several different devices.

According to another embodiment, the right can be used several times.This could be done e.g., for a limited number of times, for an unlimitednumber of times, or during a limited time period. The choice of theimplementation is free and can be determined e.g., by the right'sprovider.

1. (canceled)
 2. A method of acquiring conditional access content,comprising: receiving at least one access right to said conditionalaccess content on a first terminal of a user, the first terminalincluding a local communication mechanism for receiving the access rightand a remote communication mechanism; storing said at least one accessright in said first terminal; sending, by the first terminal using theremote communication mechanism, said at least one access right to acontent provider with at least an identifier of an account to which saidfirst terminal is associated; sending a request for said conditionalaccess content to the content provider, said request including at leastan identifier of the account to which said first terminal is associatedand an identifier of said conditional access content; and receiving saidconditional access content by the first terminal after successfulverification of said at least one access right for said account.
 3. Themethod according to claim 2, wherein the at least one access rightincludes two access rights, and the method further comprises: storingthe two access rights in said first terminal; sending, by the firstterminal using the remote communication mechanism, said two accessrights to the content provided with at least the identifier of theaccount; and receiving said conditional access content by the firstterminal after successful verification of said two access rights forsaid account.
 4. The method according to claim 2, wherein theconditional content is linked to conditions for us.
 5. The methodaccording to claim 4, wherein the conditions for use depend on at leasta type of said first terminal.
 6. The method according to claim 3,wherein the two access rights are accumulated in order to gain access tothe conditional content.
 7. The method according to claim 3, wherein therequest further includes a verification code used by the contentprovider to verify authenticity of the two access rights.
 8. The methodaccording to claim 2, wherein said local communication mechanismincludes a near field communication (NFC) mechanism.
 9. A terminal thatacquires conditional access content, comprising: circuitry configured toreceive at least one access right to said conditional access content;storing said at least one access right; sending said at least one accessright to a content provider with at least an identifier of an account towhich the terminal is associated; sending a request for said conditionalaccess content to the content provider, said request including at leastan identifier of the account to which said terminal is associated and anidentifier of said conditional access content; and receiving saidconditional access content after successful verification of said atleast one access right for said account.
 10. the terminal according toclaim 9, wherein the at least one access right includes two accessrights, and the circuitry is further configured to: store the two accessrights in said first terminal; send said two access rights to thecontent provided with at least the identifier of the account; andreceive said conditional access content by the first terminal aftersuccessful verification of said two access rights for said account. 11.The terminal according to claim 9, wherein the conditional accesscontent is linked to conditions for us.
 12. The terminal according toclaim 11, wherein the conditions for use depend on at least at type ofthe terminal.
 13. The terminal according to claim 10, wherein the twoaccess rights are accumulated in order to gain access to the conditionalaccess content.
 14. The terminal according to claim 10, wherein therequest further includes a verification code used by the contentprovider to verify authenticity of the two access rights.
 15. Theterminal according to claim 9, wherein the circuitry includes a nearfield communication (NFC) mechanism.